Package: flashplugin-nonfree Version: 1:1.5 Severity: normal Tags: security
The postrm runs update-flashplugin-nonfree, which always tries to download a new version of itself, even when run with --uninstall. So, if people.debian.org is down (as it was recently), removal of the package will seem to hang. (Seen reported on debian-user.) Furthermore, I think it should be possible to remove the package w/o downloading and running code from the net. For one thing, what if the mechanism used to verify the code got broken (ie, your key was compromised somehow). Similarly, update-flashplugin-nonfree --uninstall is run by the prerm on upgrade, which could in some situations be bad (verification mechanism broken, spoofed dns, the package update that was supposed to fix the security hole instead running the old, insecure code verifier and thus running malicious code. -- System Information: Debian Release: lenny/sid APT prefers unstable APT policy: (500, 'unstable'), (500, 'testing'), (500, 'stable') Architecture: i386 (i686) Kernel: Linux 2.6.25-2-686 (SMP w/1 CPU core) Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/bash Versions of packages flashplugin-nonfree depends on: ii debconf [debconf-2.0] 1.5.22 Debian configuration management sy ii fontconfig 2.6.0-1 generic font configuration library ii gnupg 1.4.9-2 GNU privacy guard - a free PGP rep ii libatk1.0-0 1.22.0-1 The ATK accessibility toolkit ii libc6 2.7-12 GNU C Library: Shared libraries ii libcairo2 1.6.4-4 The Cairo 2D vector graphics libra ii libexpat1 2.0.1-4 XML parsing C library - runtime li ii libfontconfig1 2.6.0-1 generic font configuration library ii libfreetype6 2.3.5-1+b1 FreeType 2 font engine, shared lib ii libglib2.0-0 2.16.3-2 The GLib library of C routines ii libgtk2.0-0 2.12.10-2 The GTK+ graphical user interface ii libice6 2:1.0.4-1 X11 Inter-Client Exchange library ii libpango1.0-0 1.20.2-2 Layout and rendering of internatio ii libpng12-0 1.2.27-1 PNG library - runtime pn libsm6 <none> (no description available) ii libx11-6 2:1.1.4-2 X11 client-side library ii libxau6 1:1.0.3-3 X11 authorisation library ii libxcursor1 1:1.1.9-1 X cursor management library ii libxdmcp6 1:1.0.2-3 X11 Display Manager Control Protoc ii libxext6 2:1.0.4-1 X11 miscellaneous extension librar ii libxfixes3 1:4.0.3-2 X11 miscellaneous 'fixes' extensio ii libxi6 2:1.1.3-1 X11 Input extension library ii libxinerama1 2:1.0.3-2 X11 Xinerama extension library ii libxrandr2 2:1.2.2-2 X11 RandR extension library pn libxrender1 <none> (no description available) ii libxt6 1:1.0.5-3 X11 toolkit intrinsics library ii wget 1.11.3-1 retrieves files from the web ii zlib1g 1:1.2.3.3.dfsg-12 compression library - runtime flashplugin-nonfree recommends no packages. -- debconf information excluded -- see shy jo
signature.asc
Description: Digital signature
